The present invention relates to isolation systems for electrically isolating access points on a machine and more particularly relates to an isolation configuration which uses safety relays and switches which redundantly isolate and ground an electrical system during lock-out conditions.
An exemplary automated manufacturing line may include several hundred electrically powered devices arranged in device sets at separate manufacturing stations, a separate manufacturing process performed by each device at each station. For example, the devices may include robots, drills, mills, transfer lines, clamps, mixing machines, stuffing machines, drying machines and so on, each of which is linked to one or more loads such as motors for driving the devices through required movements and processes.
While the inventive configuration is meant to be used with many different line arrangements and device groupings, to simplify the present explanation the invention will be described in the context of an exemplary assembly line 300 for, referring to FIG. 4, manufacturing widgets wherein the line includes devices arranged at ten consecutive stations 302, 304, 306, 308, 310, 312, 314, 316, 318 and 320 and wherein each station includes a plurality of devices (not separately illustrated) which cooperate to perform a complete process. A conveyor 322 or other mechanism powered by a motor 321 moves work items (not illustrated) from one station to the next. In many cases a conveyor will be 3000 or more feet long and may require more than a single motor to facilitate conveyance. In addition, as is standard in the industry, a single master controller including a master control panel 324 is provided to control and monitor the entire manufacturing process. To this end, panel 324 includes, among other things, miscellaneous controls 350 and a master or main disconnect 334. The master control panel 324 is provided to control voltages on supply lines 326 which pass through the controller and run along the entire packaging line to each of stations 302 through 320 and to a variable frequency drive (VFD) 328 which controls motor 321. To control station power, disconnect 334 links lines 326 to station controls 330.
When designing a manufacturing or processing line one of the primary considerations is line safety as many of the devices at each line station may inflict injury to an operator in the station vicinity. Typical injuries including mechanical injury (e.g., falling, crushing, puncture, etc.). For this reason many stations, and in some cases all stations, will be enclosed in a housing assembly to ensure that an operator does not inadvertently enter a potentially hazardous station environment. Hereinafter an exemplary enclosure will be referred to as a station and the station or device grouping therein will sometimes be referred to as a hazard to indicate the potential danger associated therewith.
Despite painstaking design of the processing line stations and of the control method associated therewith, often processing problems can occur which require operator intervention to alleviate the problems. For example, in the case of the exemplary processing line described above, assume that a riveting station 302 or hazard is set up to fire rivets into work items as the items are transferred therethrough. If a work item becomes jammed between station devices the item may cause a backlog of work items at the station and, possibly cause additional jamming. In this case, to eliminate the jamb, an operator would have to enter station 302 and physically remove the jamb.
To facilitate operator intervention, typically line access points are provided. In the present example, it will be assumed that a cage is formed about riveting station 302 and that an opening there into is formed in the cage.
To ensure that an operator entering a station via an access point is not injured, standard practice within the industry requires that power to the station be entirely cut off via a power down mechanism. By cutting off power to the station, all station devices cease mechanical movement and the possibility of injury is essentially eliminated.
Referring still to FIG. 4, primitive and still prevalent power down mechanisms include a master or main disconnect switch 334 linked to the master control panel. To cut power, switch 334 is tripped which causes power to the entire line to shut down. Because the master control panel 324 is often remote (e.g., perhaps 3000 feet) from some line stations, it is always possible that a second operator may reclose disconnect switch 324 while a first operator is within a station thereby causing a potential hazard. To eliminate this possibility the industry has configured standard lockout disconnect switches and has devised standard lockout-tag out procedures. To this end, after a disconnect switch is opened, the switch can be locked in the open position and tagged (i.e., an actual tag is placed on the lock identifying the operator) by the operator who locked the switch to ensure that the switch remains open.
While the master disconnect switch 334 is advantageous, a system including only a master switch 334 is disadvantageous for several reasons. First, as indicated above, typically the switch is located at a master control panel 324 which may be remote from an access point. In this case, once the operator recognizes a problem which requires operator intervention, the operator has to halt line operation, run to the master control panel 324, open the master disconnect switch 334, lock out and tag the switch 334, perform a lockout/tag out power off verification to ensure lockout and tag out, walk back to the problem station 312, access the station 312 to eliminate the problem, walk back to the control panel 324, untag and unlock the disconnect switch 334, close the switch 334 and then start the process once again. While this process may not seem burdensome where a processing line is relatively short (e.g., 10 stations long), this process is extremely burdensome in cases where a line may have many stations which may be up to 3000 or more feet from the master control panel 324 where problems occur routinely (e.g., several times per operator shift).
In addition to being burdensome, this process is also relatively expensive for two reasons. First, employee time is expensive and any process which requires an employee to traverse from one point to another without being productive reduces processing line efficiency. Second, during the time when the line is powered down, output is stalled. The time required to travel to and from the disconnect switch reduces line output. While this may be relatively unimportant in cases where inexpensive products are being processed, down time and the resulting production loss is extremely important where expensive products (e.g., vehicles, etc.) are being manufactured.
Second, the electrical contacts on typical disconnect switches effectively wear out over the course of a relatively short life time. For example, Underwriter's Laboratories mandates 10,000 operations and good disconnect switches last for approximately twenty thousand switching cycles prior to required replacement.
Third, disconnect switches are purposefully designed such that an extremely large force is required to open or close the switch. Such a design substantially reduces the possibility of inadvertent switching. Unfortunately, the required force also places excessive stresses on the disconnect switch mechanical components which often cause mechanical failure (e.g., breakage).
To address the shortcomings of systems which include a single master disconnect switch, the industry has developed a voltage supervision relay (VSR) based system for locally cutting off power to a station thereby electrically isolating the station. To this end, referring to FIG. 1, an exemplary system 10 is illustrated in the context of a station or hazard 12 which is linked to three voltage supply lines L1, L2 and L3. For each hazard 12, system 10 includes an isolation relay, a VSR, a system lockout switch (SLS) 18 and a safety light 20.
SLS 18 includes first and second contacts 22 and 24 which are mutually exclusive (i.e., when one contact 22, 24 is closed, the other 22 or 24 is open and vice versa).
The VSR includes, among other things, voltage sensing and comparison hardware and a VSR coil represented by a VSR block 16 and two normally open (NO) contacts VSR-1 and VSR-2. The isolation contactor includes a coil and positively guided contacts including three NO contacts IC-1, IC-2 and IC-3 and one normally closed (NC) contact IC-4.
Lines L1 and L2 are used to provide power to VSR block 16, coil 14 and light 20. To this end, line L1 forms a voltage rail 26 while line L2 forms a voltage rail 28. Contacts VSR-1 and VSR-2 are in series with SLS contact 22 and safety light 20 between rails 26 and 28. Similarly, SLS contact 24 is in series with coil 14 between rails 26 and 28.
Block 16 is linked between each of contacts IC-1, IC-2 and IC-3 and hazard 12 for sensing voltage thereat. Contact IC-4 is linked to block 16 as an enabling contact. Block 16 only operates when contact IC-4 is closed. After sensing voltages, block 16 compares the sensed voltages to a threshold voltage (e.g., 10 volts) to determine if power is being provided to hazard 12. Where power is provided to hazard 12, current is not provided to the VSR coil and therefore contacts VSR-1 and VSR-2 remain open. Where power is not provided to hazard 12, current is provided to the VSR coil and therefore contacts VSR-1 and VSR-2 both close.
Referring still to FIG. 1, during normal operation, SLS 18 is in an ON position wherein contact 22 is open and contact 24 is closed. In this case current passes through isolation coil 14 so that contacts IC-1, IC-2 and IC-3 are closed and contact IC-4 is open. Because contact 22 is open, light 20 is off.
Next, assuming a process malfunction associated with hazard 12 causes a problem which must be eliminated by an operator, first the operator locally turns off the motor drive. Second, the operator locally (i.e., proximate hazard 10 and the process malfunction) turns SLS 18 from ON to OFF thereby opening contact 24 and closing contact 22. When contact 24 is opened, current to coil 14 is cut off such that contacts IC-1, IC-2 and IC-3 are all opened while contact IC-4 is closed thereby enabling block 16.
Because each of contacts IC-1, IC-2 and IC-3 are all open, VSR block 16 should not sense a voltage above the threshold voltage. On one hand, where the sensed voltages are below the threshold voltage, block 16 energizes the VSR coil and hence closes contacts VSR-1 and VSR-2 causing light 20 to illuminate. Illuminated light 20 indicates that hazard 12 has been electrically isolated and that entry through an associated access point should be safe. After lockout and tag out procedures, the operator can enter hazard 12 to eliminate the problem.
On the other hand, where block 16 senses one or more voltages which are greater than the threshold voltage, block 16 does not energize the VSR coil and hence contacts VSR-1 and VSR-2 remain open despite closed switch 22. In this case, light 20 is not illuminated and the operator knows it is not safe to service hazard 12.
This VSR system works well but has two primary shortcomings. First, VSR block 16 is relatively expensive and increases system costs appreciably over the simple disconnect switch configuration.
Second, the VSR is not field repairable, is difficult to understand and is difficult to trouble shoot.
Therefore, a need exists to provide a safe and relatively inexpensive system for remotely (e.g., locally) electrically isolating machines or processing/manufacturing line hazards. Preferably the such a system would ensure that no current or voltage is provided to a hazard during lockout conditions.